1. Scope

Dropit is a personal archiving service operated by MOTG through the Dropit Chrome Extension, Telegram Bot and Mini App, and web app. This policy describes the data handled by those interfaces.

2. Data we handle

Account and authentication data

• Telegram platform account identifiers.
• Historical KakaoTalk platform account identifiers linked before KakaoTalk support ended on October 3, 2026. Dropit no longer collects new KakaoTalk data.
• Google account ID, verified email address, and, when available, display name. Dropit does not use an email address to automatically merge accounts. Cross-platform linking requires the user's explicit code-based action.
• An internal Dropit user identifier.
• One-time linking codes and signed authentication tokens.
• In the web app, Google email and display name may be stored in the browser for account display. The server uses the Google account ID to maintain the account link.

Content and browser data

• URLs, text memos, to-dos, search terms, categories, favorites, reminders, and settings that the user chooses to submit.
• For the Chrome Extension, the current page URL and title are read so the side panel can show the page. They are sent to the Dropit server only when the user chooses Save this page.
• Page title, description, thumbnail, transcript or page text needed to classify and summarize a saved link.
• AI-generated categories, summaries, and weekly reports.

Local storage and operational data

• The extension stores the signed authentication token and theme preference in Chrome local storage. Short-lived interface state may use Chrome session storage.
• The web app uses browser local or session storage for its signed token, display preferences, and Google account display information.
• Hosting and infrastructure providers may process request metadata such as IP address, date/time, user agent, error information, and limited account/content identifiers or saved-URL excerpts written by the service in operational logs.
• The website loads Google Analytics and Microsoft Clarity. Google Analytics receives an internal Dropit user ID or Telegram user ID when available, a platform label, page/app activity, feature events, tab names, and the complete saved URL when a bookmark is opened from the web app, together with standard browser and request metadata. Microsoft Clarity may process page views, session interactions, and device/browser or similar technical identifiers according to its script and project configuration. These services may use cookies or comparable browser identifiers.

Dropit does not collect contacts, address books, precise location, payment information, financial information, health information, or passwords. The extension package itself does not embed analytics scripts or call Google Analytics or Microsoft Clarity directly. If a user opens the full Dropit archive from the extension, the separately loaded Dropit website uses the analytics described above and labels that web session as originating from the extension.

3. How we use data

We use data only to:

• authenticate the user and keep accounts separated;
• save, organize, search, display, and synchronize the user's archive;
• fetch metadata and create AI categories or summaries for links the user chose to save;
• detect duplicate links;
• link or unlink accounts when the user explicitly requests it;
• deliver requested bot messages and opted-in weekly reports;
• maintain security, reliability, and prevent abuse;
• measure use of the Dropit website and its features; and
• understand website sessions and interactions.

We do not sell user data, use it for personalized advertising, transfer it to data brokers, or use it for credit or lending decisions.

4. Sharing and processors

We share data only as needed for the purposes described in this policy:

Each provider processes data under its own terms and privacy policy. Dropit does not use these analytics integrations for personalized advertising or sale of user data.

5. Account linking

Account linking is voluntary. A linking code becomes unusable after 5 minutes and is single-use. Used, replaced, or explicitly checked expired codes are removed, but Dropit does not currently run a separate automatic deletion schedule for untouched expired code rows. A code links the identities selected by the user; Dropit does not automatically merge accounts by matching email address. Unlinking does not automatically delete archived content.

6. Authentication lifetime and storage

• Standard signed tokens expire after 24 hours.
• Long-lived tokens used by the Chrome Extension and web sign-in expire after 30 days.
• Tokens are self-contained signed credentials and are not stored as plaintext passwords in the Dropit database.
• An extension token can remain in Chrome local storage until logout, extension data removal, or replacement, but the server rejects it after its signed expiry.
• Saved archive data has no automatic expiry. It remains until the user deletes individual items or submits a verified account-deletion request to MOTG; account deletion is currently handled as a manual support process.
• Historical KakaoTalk identifiers and content submitted through the former integration follow the same retention and deletion rules above.
• Provider operational logs are retained under the applicable provider configuration and policy.
• Google Analytics and Microsoft Clarity retention periods are not specified in this repository, and the live project retention settings were not verified for this release. Their records remain subject to the operator's configured settings and each provider's policy; no automatic deletion period is promised here.

7. Security

User data is transmitted over HTTPS. Database and service credentials are restricted to server-side configuration. Dropit validates signed tokens, uses time-limited single-use account-linking codes, and limits server-side URL fetching to public network addresses. No method of storage or transmission is completely risk-free.

8. User choices and rights

Users may request access, correction, export, deletion, or account unlinking by contacting MOTG. The service may ask for reasonable identity verification before acting on a request. Deleting the extension removes its local browser storage; it does not by itself delete server-side archive data.

9. Chrome Web Store Limited Use

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Data obtained through Chrome Extension permissions is used only to provide or improve Dropit's single purpose: letting the user save and retrieve web pages in their personal archive. We do not allow humans to read that data except with the user's explicit consent for support, when necessary for security, when required by law, or after aggregation and anonymization for lawful internal operations.

10. Children

Dropit is not intended for children under 13, and MOTG does not knowingly collect their data.

11. Changes

If data practices change, this policy and any required in-product or store disclosures will be updated before the changed collection begins.

12. Contact

• Company: MOTG
• Email: [email protected]
• Telegram: @mook2mook25